From 736e6f3b6eb9aee3404f0f4bf79dde9c8f16ef44 Mon Sep 17 00:00:00 2001 From: Forge Recovery Date: Sun, 1 Nov 2026 19:49:46 +0000 Subject: [PATCH 1/2] fix(ci): build on Xcode 27 SDK and allowlist Sparkle public key - Qualify swift-markdown's Document: SwiftUI now exports its own Document protocol, making the bare name ambiguous. - Allowlist the Sparkle SUPublicEDKey (an EdDSA public verification key, not a secret) for gitleaks. Co-Authored-By: Claude Sonnet 5.5 --- .gitleaks.toml | 12 ++++++++++++ markdownViewr/MarkdownDocument.swift | 6 +++--- 2 files changed, 15 insertions(+), 3 deletions(-) create mode 100644 .gitleaks.toml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..a327ddb --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,12 @@ +title = "markdownViewr gitleaks" + +[extend] +useDefault = true + +# Sparkle's SUPublicEDKey is the EdDSA *public* verification key, shipped inside the app +# bundle by design. It is not a credential. Match on the line, not the value, so a changed +# key or a different secret on any other line is still reported. +[allowlist] +description = "Sparkle SUPublicEDKey public verification key" +regexTarget = "line" +regexes = ['''SUPublicEDKey'''] diff --git a/markdownViewr/MarkdownDocument.swift b/markdownViewr/MarkdownDocument.swift index 212caf9..5825fd7 100644 --- a/markdownViewr/MarkdownDocument.swift +++ b/markdownViewr/MarkdownDocument.swift @@ -60,7 +60,7 @@ struct MarkdownDocument: FileDocument { let rawContent = frontmatter != nil ? body : markdown let content = preProcessSubscript(rawContent, enabled: extensions.subscript_) - let document = Document(parsing: content) + let document = Markdown.Document(parsing: content) var htmlVisitor = HTMLConverter() html += htmlVisitor.visit(document) return applyExtensions(html, extensions: extensions) @@ -127,7 +127,7 @@ struct MarkdownDocument: FileDocument { } private static func renderFrontmatterAsMarkdown(_ yaml: String) -> String { - let document = Document(parsing: "---\n\(yaml)\n---") + let document = Markdown.Document(parsing: "---\n\(yaml)\n---") var htmlVisitor = HTMLConverter() return htmlVisitor.visit(document) } @@ -275,7 +275,7 @@ struct MarkdownDocument: FileDocument { private struct HTMLConverter: MarkupWalker { private var result = "" - mutating func visit(_ document: Document) -> String { + mutating func visit(_ document: Markdown.Document) -> String { result = "" for child in document.children { visitChild(child) -- 2.54.0 From 791e487737be8fa48d8283328fa65687e496aeea Mon Sep 17 00:00:00 2001 From: Forge Recovery Date: Sun, 1 Nov 2026 19:52:09 +0000 Subject: [PATCH 2/2] fix(ci): baseline exact Sparkle public-key fingerprint instead of a pattern allowlist Co-Authored-By: Claude Sonnet 5.5 --- .gitleaks.toml | 12 ------------ .gitleaksignore | 2 ++ 2 files changed, 2 insertions(+), 12 deletions(-) delete mode 100644 .gitleaks.toml create mode 100644 .gitleaksignore diff --git a/.gitleaks.toml b/.gitleaks.toml deleted file mode 100644 index a327ddb..0000000 --- a/.gitleaks.toml +++ /dev/null @@ -1,12 +0,0 @@ -title = "markdownViewr gitleaks" - -[extend] -useDefault = true - -# Sparkle's SUPublicEDKey is the EdDSA *public* verification key, shipped inside the app -# bundle by design. It is not a credential. Match on the line, not the value, so a changed -# key or a different secret on any other line is still reported. -[allowlist] -description = "Sparkle SUPublicEDKey public verification key" -regexTarget = "line" -regexes = ['''SUPublicEDKey'''] diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..9e35fe0 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,2 @@ +# Sparkle SUPublicEDKey: EdDSA public verification key, not a secret (exact historical finding only) +b3940a3656a8dbc8d669825ed1d0cc0ec9e619d4:project.yml:generic-api-key:66 -- 2.54.0